// mountContainerV1Cgroups mounts the cgroup controllers hierarchy in the container's
// namespace read-only, leaving the needed knobs in the subcgroup for each-app
// read-write so systemd inside stage1 can apply isolators to them
func mountContainerV1Cgroups(s1Root string, enabledCgroups map[int][]string, subcgroup string, serviceNames []string) error {
mountContext := os.Getenv(common.EnvSELinuxMountContext)
if err := v1.CreateCgroups(s1Root, enabledCgroups, mountContext); err != nil {
return errwrap.Wrap(errors.New("error creating container cgroups"), err)
}
if err := v1.RemountCgroupsRO(s1Root, enabledCgroups, subcgroup, serviceNames); err != nil {
return errwrap.Wrap(errors.New("error restricting container cgroups"), err)
}
return nil
}
// mountContainerV1Cgroups mounts the cgroup controllers hierarchy in the container's
// namespace read-only, leaving the needed knobs in the subcgroup for each-app
// read-write so systemd inside stage1 can apply isolators to them
func mountContainerV1Cgroups(m fs.Mounter, s1Root string, enabledCgroups map[int][]string, subcgroup string, serviceNames []string, secopts stage1initcommon.Stage1InsecureOptions) error {
mountContext := os.Getenv(common.EnvSELinuxMountContext)
if err := v1.CreateCgroups(m, s1Root, enabledCgroups, mountContext); err != nil {
return errwrap.Wrap(errors.New("error creating container cgroups"), err)
}
if err := v1.RemountCgroups(m, s1Root, enabledCgroups, subcgroup, serviceNames, secopts.DisablePaths); err != nil {
return errwrap.Wrap(errors.New("error restricting container cgroups"), err)
}
return nil
}
// mountHostV1Cgroups mounts the host v1 cgroup hierarchy as required by
// systemd-nspawn. We need this because some distributions don't have the
// "name=systemd" cgroup or don't mount the cgroup controllers in
// "/sys/fs/cgroup", and systemd-nspawn needs this. Since this is mounted
// inside the rkt mount namespace, it doesn't affect the host.
func mountHostV1Cgroups(m fs.Mounter, enabledCgroups map[int][]string) error {
systemdControllerPath := "/sys/fs/cgroup/systemd"
if !areHostV1CgroupsMounted(enabledCgroups) {
mountContext := os.Getenv(common.EnvSELinuxMountContext)
if err := v1.CreateCgroups(m, "/", enabledCgroups, mountContext); err != nil {
return errwrap.Wrap(errors.New("error creating host cgroups"), err)
}
}
if !v1.IsControllerMounted("systemd") {
if err := os.MkdirAll(systemdControllerPath, 0700); err != nil {
return err
}
if err := m.Mount("cgroup", systemdControllerPath, "cgroup", 0, "none,name=systemd"); err != nil {
return errwrap.Wrap(fmt.Errorf("error mounting name=systemd hierarchy on %q", systemdControllerPath), err)
}
}
return nil
}